Privacy

Who is responsible for your information

GP-Hubs is operated by HOSPITALNOTE LTD trading as GP Hubs (company number 13267323), Unit 5 Red Lion Court, Alexandra Road, Hounslow, England, TW3 1JS. For the GP-Hubs service, Hospitalnote Ltd is the main contact for privacy questions. The dispensing pharmacy and individual clinicians may also have independent legal duties for records they hold. Hospitalnote is responsible for the website and payment administration it operates. PharmKG Ltd, trading as Pharmacy + Me, provides prescribing services. Pharmacy Warehouse Ltd separately provides dispensing services. These providers have their own professional record-keeping duties. The clinical team uses Hospitalnote to manage assessments and care; individual professionals may have separate legal duties for the records they hold. Our About & regulation page identifies the team and dispensing premises.

For a privacy request, contact info@gphubs.com, use secure messaging in your patient portal or write to our registered office, marked ‘Privacy request’. Please do not send sensitive health details by ordinary email.

Information we collect

We collect your name, date of birth, contact and delivery details, account credentials, consultation answers, medical history, current medicines, allergies, messages, prescription and dispensing records, and information you provide during follow-up. We also record order, payment status, delivery and customer-service information. Where identity verification is required, we collect photo ID, a selfie and the information needed to record the staff review and its outcome through the secure patient portal.

We receive technical information such as IP address, device and browser details, and security logs when you use the website. A clinician, pharmacist or delivery provider may give us information relevant to your request. We ask for information needed to assess your suitability and fulfil an approved order; without it, we may be unable to provide the service.

How and why we use it

We use account, order and delivery information to provide the service you request (UK GDPR Article 6(1)(b)); clinical information to assess suitability, prescribe where appropriate, dispense, provide follow-up care and maintain clinical records (Article 6(1)(b) and/or 6(1)(c), as applicable, and the health-care condition in Article 9(2)(h), subject to professional confidentiality).

We use records to meet legal and regulatory duties (Article 6(1)(c)), and limited technical and transaction information to secure the service, prevent fraud, handle complaints and improve reliability where our legitimate interests are not overridden by your rights (Article 6(1)(f)). We use consent where required for optional marketing or non-essential cookies. Withdrawing consent does not affect processing already carried out or records we must keep.

Who receives information

Relevant information may be shared with authorised prescribers, the dispensing pharmacy, Hospitalnote as the clinical record system, payment processors, delivery companies, hosting and support providers, and regulators where necessary. A delivery company should receive only what it needs to deliver the parcel. We may contact your GP or another care provider when clinically appropriate or required by law.

We use Stripe for hosted card checkout and payment processing. Stripe receives the transaction amount, currency, generic service descriptions and internal payment references, and collects the payment details you enter on its page. Questionnaire answers, medicine names and delivery addresses are not included in the payment-session metadata. Clinical decisions remain in Hospitalnote. We do not sell patient information.

Storage, transfers and retention

We limit access to people who need the information for their role and use appropriate security controls. Clinical assessment, prescription and dispensing records are retained according to their purpose, continuity-of-care needs, professional record-keeping duties and applicable legal claims periods. Payment and refund records are retained to meet accounting, tax and dispute obligations. Security logs are retained for fraud investigation and service protection only as long as needed for those purposes. We review retention against these criteria; account closure does not automatically erase clinical or financial records. Contact info@gphubs.com for the retention period or criteria applicable to a particular record.

Payment and other service providers may process information outside the UK. Where a restricted transfer occurs, applicable data protection law requires an appropriate basis, such as UK adequacy regulations or contractual safeguards. Contact info@gphubs.com for details of the providers, processing locations and safeguards relevant to your information. We do not claim that all processing takes place in the UK.

Your choices and rights

You may request access, correction or erasure of your information, restrict or object to certain processing, and ask for portable data where the law applies. You can withdraw consent for optional processing at any time. Clinical and legal record-keeping obligations can limit some requests. Send requests through secure portal messaging or to the postal address above.

You can complain to the Information Commissioner’s Office at ico.org.uk if you are unhappy with our response. You may also contact us first so we can try to resolve the concern.

Cookies and decisions

We use essential sign-in cookies and session storage for assessment drafts, including health answers and delivery details, while you use the service. The website currently has no advertising or analytics trackers. Read the Cookies policy for names, durations, purposes and controls for clearing browser drafts.

A questionnaire supports screening, but a registered prescriber makes the clinical decision. We do not use solely automated decision-making to approve a prescription.

Manage your information

You can contact us without signing in. For privacy requests, email info@gphubs.com. Use the secure portal rather than ordinary email to send clinical documents.

• Contact us about privacy
• Browser storage and clearing drafts
• Raise a data protection concern with the ICO

Changes to this notice

We will publish material changes here and, where appropriate, tell account holders directly. The date above shows when this notice was last updated.